Schema Reference
The application schema is used to configure the objects returned from a connector.
Note
-
The Account Schema tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as Entitlement or Multi-Valued. Refer to Managing Source Account Schemas for more information.
-
The schema attributes that are not present by default must be defined as strings if not specified.
The Microsoft Active Directory connector uses the following default correlation and object configurations.
Default Account Schema
Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.
The set of account attributes each source stores and how they're organized is known as the account's schema. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to Managing Source Account Schemas for more information.
Default Account ID
SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as account IDs.
Caution
Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
To resolve issues caused by changing account IDs, reconfigure them to their default values.
The following table lists the default account IDs for this connector:
| Account ID | Schema Object Type |
|---|---|
| distinguishedName | Account |
| distinguishedName | Group |
Default Account Attributes
The Microsoft Active Directory connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.
Note
Attributes with an asterisk (*) are the Terminal Services/Remote Desktop Services attributes. By default, these attributes are not added to the schema and provisioning policy for performance optimization. To manage Terminal Services attributes, add these attributes to the schema and provisioning policy. See Attributes for Terminal Services.
Important
When an attribute contains more than 1500 values, ensure to define it as a multi-valued attribute.
| Attribute Name | Description |
|---|---|
| accountFlags | This attribute contains a list of the flags enabled on an account. |
| businessCategory | The types of business performed by an organization. Each type is one value of this multi-valued attribute. For example, "engineering", "finance", and "sales". |
| carLicense | This attribute type contains the license plate or vehicle registration number associated with the user. |
| cn | This attribute type contains names of an object. Each name is one value of this multi-valued attribute. If the object corresponds to a person, it is typically the person's full name. For example, "Martin K Smith", "Marty Smith" and "printer12". |
| department | This attribute contains the user's department. |
| departmentNumber | This attribute contains a numerical designation for a department within your enterprise. |
| description | This attribute type contains human-readable descriptive phrases about the object. Each description is one value of this multi-valued attribute. For example, "Updates are done every Saturday, at 1am.", and "distribution list for sales". |
| destinationIndicator | This attribute type contains country and city strings associated with the object (the addressee) needed to provide the Public Telegram Service. The strings are composed in accordance with CCITT Recommendations F.1 [F.1] and F.31 [F.31]. Each string is one value of this multi-valued attribute. For example, "AASD" as a destination indicator for Sydney, Australia. "GBLD" as a destination indicator for London, United Kingdom. The directory does not ensure that values of this attribute conform to the F.1 and F.31 CCITT recommendations. It is the application's responsibility to ensure destination indicators that it stores in this attribute are appropriately constructed. |
| displayName | This attribute contains the preferred name to be used for this person throughout the application. |
| distinguishedName | This attribute contains the distinguished name by which the user is known. This default attribute must not be changed for a provisioning operation. |
| dNSHostName | This attribute contains the fully qualified domain name for the service account. |
| employeeNumber | This attribute contains the numerical identification key for this person within your enterprise. |
| employeeType | This attribute contains a descriptive type for this user. For example, contractor, full time, or part time. |
| externalEmailAddress | This attribute contains external email address of the mail user. Mail user is an AD user having mailbox outside of organization. |
| facsimileTelephoneNumber | This attribute type contains telephone numbers and any required parameters for facsimile terminals. Each telephone number is one value of this multi-valued attribute. |
| givenName | This attribute type contains name strings that are the part of a person's name that is not their surname. Each string is one value of this multi-valued attribute. For example, "John", "Sue", and "David". |
| homeMDB | Exchange mailbox store DN. Required for mailbox creation. |
| homePhone | This attribute contains the employees home phone number. |
| homePostalAddress | This attribute contains the employees mailing address. |
| initials | This attribute type contains strings of initials of some or all of an individual's names, except the surname(s). Each string is one value of this multi-valued attribute. For example, "J. A." and "J". |
| internationalISDNNumber | This attribute type contains Integrated Services Digital Network (ISDN) addresses, as defined in the International Telecommunication Union (ITU) Recommendation E.164 [E.164]. Each address is one value of this multi-valued attribute. For example, "0198 444 444". |
| l | This attribute type contains names of a locality or place, such as a city, county, or other geographic region. Each name is one value of this multi-valued attribute. For example, "Austin", "Chicago", and "Brisbane". |
| This attribute type contains the RFC822 mailbox for the user. | |
| mailNickname | Exchange Alias. |
| manager | This attribute type contains the distinguished name of the manager to whom this person reports. |
| memberOf | This attribute type contains the account group membership for this person on the application. |
| memberOfSharedMailbox | This attribute type contains a list of shared mailboxes that the user has permissions for. |
| mobile | This attribute type contains the mobile telephone number of this person. |
| msDS-PrincipalName | Name of the entity in the following format: NetBIOS domain name\sAMAccountName. |
| msExchHideFromAddressLists | Hide from Exchange address lists. |
| msExchRecipientTypeDetails | This attribute type contains the type of the Microsoft Exchange recipient object. |
| msNPAllowDialin | Indicates whether the account has permission to dial in to the RAS server. |
| msNPCallingStationID | If this property is enabled, the server verifies the caller's phone number. If the caller's phone number does not match the configured phone number, the connection attempt is denied. |
| msRADIUSCallbackNumber | The phone number that is used by the server is set by either the caller or the network administrator. If this property is enabled, the server calls the caller back during the connection process. |
| msRADIUSFramedIPAddress | Use this property to assign a specific IP address to a user when a connection is made. |
| msRADIUSFramedRoute | Define a series of static IP routes that are added to the routing table of the server running the Routing and Remote Access service when a connection is made. |
| NetBIOSName | Domain NetBIOS Name of the account. |
| o | This attribute type contains the names of an organization. Each name is one value of this multi-valued attribute. |
| objectClass | The values of the objectClass attribute describe the kind of object which an entry represents. The objectClass attribute is present in every entry, with at least two values. One of the values is either "top" or "alias". |
| objectguid | Globally unique identifier of the object. |
| objectSid | Windows Security Identifier. |
| objectType | Indicates type of the Active Directory objects. For example, User, Contact |
| ou | This attribute type contains the names of an organizational unit. Each name is one value of this multi-valued attribute. For example, "Sales", "Human Resources", and "Information Technologies". |
| pager | This attribute type contains the telephone number of this person's pager. |
| physicalDeliveryOfficeName | This attribute type contains names that a Postal Service uses to identify a specific post office. For example, "Austin, Downtown Austin" and "Chicago, Finance Station E". |
| postalAddress | This attribute type contains addresses used by a Postal Service to perform services for the object. Each address is one value of this multi-valued attribute. For example, "1111 Elm St.AustinTexas$USA". |
| postalCode | This attribute type contains codes used by a Postal Service to identify postal service zones. Each code is one value of this multi-valued attribute. For example, "78664", to identify Pflugerville, TX, in the USA. |
| postOfficeBox | This attribute type contains postal box identifiers use by a postal service to locate a box on the premises of the Postal Service rather than a physical street address. Each postal box identifier is a single value of this multi-valued attribute. For example, "Box 27". |
| preferredDeliveryMethod | This attribute type contains an indication of the preferred method of getting a message to the object. For example, if the mhs-delivery Delivery Method is preferred over telephone-delivery, which is preferred over all other methods, the value would be: "mhs $ telephone". |
| preferredLanguage | This attribute type contains the preferred written or spoken language of this person. |
| primaryGroupDN | This attribute contains the distinguished name of the user's primary group. |
| primaryGroupID | This attribute contains the RID of the user's primary group. |
| pwdLastSet | This attribute contains the time of the last password reset. |
| registeredAddress | This attribute type contains postal addresses to be used for deliveries that must be signed for or require a physical recipient. Each address is one value of this multi-valued attribute. For example, "ReceptionistXYZ Technologies6034 Courtyard Dr.Austin, TXUSA". |
| roomNumber | This attribute type contains the room or office number or this person's normal work location. |
| sAMAccountName | This attribute type contains the sAMAccountName for this user. |
| secretary | This attribute type contains the distinguished name of this person's secretary. |
| seeAlso | This attribute type contains the distinguished names of objects that are related to the subject object. Each related object name is one value of this multi-valued attribute. For example, the person object "cn=Elvis Presley,ou=employee,o=XYZ\, Inc." is related to the role objects "cn=Bowling Team Captain,ou=sponsored activities,o=XYZ\, Inc." and "cn=Dart Team,ou=sponsored activities,o=XYZ\, Inc.". Since the role objects are related to the person object, the seeAlso attribute contains the distinguished name of each role object as separate values. |
| shadowAccountDN | This attribute contains the distinguished name of the linked mailbox shadow account. |
| shadowAccountGuid | This attribute contains the ObjectGuid of the linked mailbox shadow account. |
| sn | This attribute type contains name strings for surnames, or family names. Each string is one value of this multi-valued attribute. For example, "Smith". |
| st | This attribute type contains the full names of states or provinces. Each name is one value of this multi-valued attribute. For example, "Texas". |
| street | This attribute type contains site information from a postal address (that is, the street name, place, avenue, and the house number). Each street is one value of this multi-valued attribute. For example, "15 Main St.". |
| telephoneNumber | This attribute type contains telephone numbers that comply with the ITU Recommendation E.123 [E.123]. Each number is one value of this multi-valued attribute. |
| teletexTerminalIdentifier | The withdrawal of Recommendation F.200 has resulted in the withdrawal of this attribute. |
| telexNumber | This attribute type contains sets of strings that are a telex number, country code, and answer back code of a telex terminal. Each set is one value of this multi-valued attribute. |
| title | This attribute type contains the persons job title. Each title is one value of this multi-valued attribute. For example, "Vice President", "Software Engineer", and "CEO". |
| uid | This attribute type contains computer system login names associated with the object. Each name is one value of this multi-valued attribute. For example, "s9709015", "admin", and "Administrator". |
| userPrincipalName | This attribute contains the unique name of the entity within the domain using the format name@domain. |
List of LDAP Attribute Names and Associated Name in Active Directory
Active Directory Display Names and LDAP Names to be used while importing as a CSV file.
| Name in Active Directory | LDAP Name (Header in CSV File) |
|---|---|
| First Name | givenName |
| Middle Name/Initials | initials |
| Last Name | sn |
| Logon Name | userPrincipalName |
| Logon Name (Pre Windows 2000) | sAMAccountName |
| Display Name | displayName |
| Full Name | name/cn |
| Description | description |
| Office | physicalDeliveryOfficeName |
| Telephone Number | telephoneNumber |
mail |
|
| Web Page | wWWHomePage |
| Password | password |
| Street | streetAddress |
| PO Box | postOfficeBox |
| City | l |
| State/Province | st |
| Zip/Postal Code | postalCode |
| Country | co |
| Country 2 Digit Code - e.g., US | c |
| Country Code - e.g., 840 for the US | countryCode |
| Add to Groups | memberOf |
| Remove from Groups | removememberOf |
| Account Expires (use the same date format as the server) | accountExpires |
| User Account Control | userAccountControl |
| User Photo | thumbnailPhoto / exchangePhoto (supports high resolution photos) / jpegPhoto / photo / thumbnailLogo |
| Profile Path | profilePath |
| Login Script | scriptPath |
| Home Folder | homeDirectory |
| Home Drive | homeDrive |
| Log on to | userWorkstations |
| Home | homePhone |
| Pager | pager |
| Mobile | mobile |
| Fax | facisimileTelephoneNumber |
| IP Phone | ipPhone |
| Notes | info |
| Title | title |
| Department | department |
| Company | company |
| Manager | manager |
| Mail Alias | mailNickName |
| Simple Display Name | displayNamePrintable |
| Hide from Exchange Address Lists | msExchHideFromAddressLists |
| Sending Message Size (KB) | submissionContLength |
| Receiving Message Size (KB) | delivContLength |
| Accept Messages from Authenticated Users Only | msExchRequireAuthToSendTo |
| Reject Messages From | unauthOrig |
| Accept Messages From | authOrig |
| Send on Behalf | publicDelegates |
| Forward To | altRecipient |
| Deliver and Redirect | deliverAndRedirect |
| Recipient Limits | msExchRecipLimit |
| Use Mailbox Store Defaults | mDBuseDefaults |
| Issue Warning at (KB) | mDBStorageQuota |
| Prohibit Send at (KB) | mDBOverQuotaLimit |
| Prohibit Send and Receive at (KB) | mDBOverHardQuotaLimit |
| Do not Permanently Delete Messages Until the Store Has Been Backed Up | deletedItemFlags |
| Keep Deleted Items for (days) | garbageCollPeriod |
| Outlook Mobile Access | msExchOmaAdminWirelessEnable |
| Outlook Web Access | protocolSettings |
| Allow Terminal Server Logon | tsAllowLogon |
| Terminal Services Profile Path | tsProfilePath |
| Terminal Services Home Directory | tsHomeDir |
| Start the Following Program at Logon | tsInheritInitialProgram |
| Starting Program File Name | tsInitialProgram |
| Start In | tsWorkingDir |
| Connect Client Drive at Logon | tsDeviceClientDrives |
| Connect Client Printer at Logon | tsDeviceClientPrinters |
| Default to Main Client Printer | tsDeviceClientDefaultPrinter |
| End Disconnected Session | tsTimeOutSettingsDisConnections |
| Active Session Limit | tsTimeOutSettingsConnections |
| Idle Session Limit | tsTimeOutSettingsIdle |
| When Session Limit Reached or Connection Broken | tsBrokenTimeOutSettings |
| Allow Reconnection | tsReConnectSettings |
| Remote Control | tsShadowSettings |
| Protect Accidental Deletion | preventDeletion |
| Manager Can Update Members | managerCanUpdateMembers |
| Primary Group ID | primaryGroupID |
| Administrative Group | msExchAdminGroup |
| Exchange Server Name | msExchHomeServerName |
| Managed By | managedBy |
externalEmailAddress (internal name: targetAddress) |
targetAddress |
| Add Proxy Addresses | proxyAddresses |
| Automatically Update Email-Address Based on Recipient Policy | msExchPoliciesExcluded |
| Employee Identifier | employeeID |
| The user's division | division |
Default Entitlement Attributes
Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to Managing Entitlements for more information.
Caution
Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.
Default Group Attributes
The Microsoft Active Directory connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.
| Attribute Name | Description |
|---|---|
| cn | This attribute type contains names of an object. Each name is one value of this multi-valued attribute. If the object corresponds to a person, it is typically the person's full name. For example, "Martin K Smith", "Marty Smith" and "printer12". |
| description | This attribute type contains human-readable descriptive phrases about the object. Each description is one value of this multi-valued attribute. For example, "Updates are done every Saturday, at 1am.", and "distribution list for sales". |
| distinguishedName | This attribute contains the distinguished name by which the user is known. |
| GroupScope | This attribute type contains the group scope. |
| GroupType | This attribute type contains the group type. |
| mailNickname | Exchange distribution group name. |
| memberOf | This attribute type contains the group membership for this person on the application. |
| msDS-PrincipalName | Name of the entity in the following format: NetBIOS domain name\sAMAccountName. |
| NetBIOSName | Domain NetBIOS Name of the group. |
| o | This attribute type contains the names of an organization. Each name is one value of this multi-valued attribute. |
| objectSid | Windows Security Identifier. |
| objectguid | Globally unique identifier of the object. |
| ou | This attribute type contains the names of an organizational unit. Each name is one value of this multi-valued attribute. For example, "Sales", "Human Resources", and "Information Technologies". |
| owner | This attribute type contains the owner of the object. |
| sAMAccountName | This attribute type contains the sAMAccountName for this group. |
Attributes for Terminal Services
Attributes marked with an asterisk (*) in Default Account Attributes are the Terminal Services/Remote Desktop Services attributes described here. By default, these attributes are not added to the schema and provisioning policy for performance optimization. To manage Terminal Services attributes, add these attributes to the schema and provisioning policy. Alternatively, you can uncomment these attributes from the connector registry and import it again.
| Attribute Name | Description |
|---|---|
| TS_TerminalServicesProfilePath | The roaming or mandatory profile path to be used when the user logs on to the RD Session Host server. |
| TS_TerminalServicesHomeDrive | The root drive for the user. |
| TS_TerminalServicesHomeDirectory | The root directory for the user. |
| TS_TerminalServicesInitialProgram | The path and file name of the application that the user wants to start automatically when the user logs on to the RD Session Host server. |
| TS_TerminalServicesWorkDirectory | The working directory path for the user. |
| TS_EnableRemoteControl | A value that specifies whether to allow remote observation or remote control of the user's Remote Desktop Services session. |
| TS_AllowLogon | A value that specifies whether the user is allowed to log on to the RD Session Host server. |
| TS_BrokenConnectionAction | A value that specifies the action to be taken when a Remote Desktop Services session limit is reached. |
| TS_ReconnectionAction | A value that specifies if reconnection to a disconnected Remote Desktop Services session is allowed. |
| TS_ConnectClientDrivesAtLogon | A value that specifies if mapped client drives should be reconnected when a Remote Desktop Services session is started. |
| TS_ConnectClientPrintersAtLogon | A value that specifies whether to reconnect to mapped client printers at logon. The value is one if reconnection is enabled, and zero if reconnection is disabled. |
| TS_DefaultToMainPrinter | A value that specifies whether to print automatically to the client's default printer. The value is one if printing to the client's default printer is enabled, and zero if it is disabled. |
| TS_MaxConnectionTime | The maximum duration of the Remote Desktop Services session, in minutes. After the specified number of minutes have elapsed, the session can be disconnected or terminated. |
| TS_MaxDisconnectionTime | The maximum amount of time, in minutes, that a disconnected Remote Desktop Services session remains active on the RD Session Host server. After the specified number of minutes have elapsed, the session is terminated. |
| TS_MaxIdleTime | The maximum amount of time that the Remote Desktop Services session can remain idle, in minutes. After the specified number of minutes has elapsed, the session can be disconnected or terminated. |
Microsoft Lync/Skype for Business Server Attributes
| Attribute Name | Description |
|---|---|
| msRTCSIP-UserEnabled | Whether the user is currently enabled for Microsoft Lync/Skype for Business Server. |
| DialPlan | Name of the user DialPlan. |
| LineServerURI | The line server URL. |
| EnabledForFederation | Whether a user is enabled for federation. |
| PublicNetworkEnabled | Whether a user is enabled for access outside the network. |
| EnterpriseVoiceEnabled | Whether a user's EnterpriseVoiceEnabled service is enabled. |
| LineURI | The line Uniform Resource Identifier (URI). |
| SipAddress | This attribute contains the SIP address of a given user. |
| VoicePolicy | The name of the Voice Policy. |
| MobilityPolicy | The name of the Mobility Policy. |
| ConferencingPolicy | The name of the Conferencing Policy. |
| PresencePolicy | The name of the Presence Policy. |
| VoiceRoutingPolicy | The name of the VoiceRouting Policy. |
| RegistrarPool | The name of the registrar pool. |
| LocationPolicy | The name of the Location Policy. |
| ClientVersionPolicy | The name of the ClientVersion Policy. |
| ClientPolicy | The name of the Conferencing Policy. |
| ExternalAccessPolicy | The name of the ExternalAccess Policy. |
| HostedVoicemailPolicy | The name of the HostedVoicemail Policy. |
| PersistentChatPolicy | The name of the PersistentChat Policy. |
| UserServicesPolicy | The name of the UserServices Policy. |
| ExperiencePolicy | The name of the Experience Policy. |
| ArchivingPolicy | The name of the Archiving Policy. |
| LegalInterceptPolicy | The name of the LegalIntercept Policy. |
| PinPolicy | The name of the Pin Policy. |
| LyncPinSet | Whether a user's pin is set. |
| LyncPinLockedOut | Whether a user's pin is locked. |
Managed Service Account Attributes
You can automate the process of adding managed service account attributes to the account schema, with the toggle option for Managed Service Account Attributes during Account Schema configuration. This reduces your efforts by automating the managed service account attributes addition process. It allows the segregation of various feature attributes within the account schema for better retrieval.
Select Include Attributes in Schema for managing service account attributes to automate the process of adding Service Account attributes to the account schema during Account Schema configuration.
Note
Only these attributes are certified for provisioning and read operations for managing Managed Service Accounts and group Managed Service Accounts (gMSA).
| Attribute Name | Description |
|---|---|
| msDS-AllowedToActOnBehalfOfOtherIdentity | Accounts that can act on the behalf of this Group Managed Service Account. Values of this multi-valued attribute must be in Distinguished Name format. IQService is required to read and provision this property. |
| msDS-GroupMSAMembership | Principals allowed to use this Group Managed Service Account. Values of this multi-valued attribute must be in Distinguished Name format. IQService is required to read and provision this property. |
| msDS-ManagedPasswordInterval | Interval in days after which Active Directory changes the password of the Managed Service Account. |
| msDS-SupportedEncryptionTypes | Supported Encryption Types for the Managed Service Account. This attribute can have multiple values. For example, RC4, AES128, AES256. |
| servicePrincipalName | Service principal names for the Managed Service Account. This attribute is multi-valued. For example, MyService/Host1.example.com. |
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.